Authentication

Where your key goes, and how to keep it safe.

Send your key in a header

Either of these works:

Authorization: Bearer bba_live_your_key
X-API-Key: bba_live_your_key

A key in the address (?key=, ?api_key=) is refused with a 400 bad_request, because addresses end up in logs and browser history.

Keys are shown once

We keep only a fingerprint of each key, never the key itself, so it is shown once when it is made. Lost it? Make a new key from your dashboard and revoke the old one.

Several keys, one account

An account can have up to 5 active keys, for example one per server. They all share your plan and its daily limit. Label them on the dashboard so you can tell them apart, and revoke any key the moment it leaks: calls with it stop at once.

From a browser

The API answers from any origin, so you can call it from a page. Do not put your key in a public page, though: anyone can read it there. Call the API from your own server and pass on what your page needs.

No key needed

GET /v1/ and GET /v1/openapi.json answer without a key.